Every value in one place every
secret safely stored

Each scope maps to a visibility pattern. Global makes a variable available to every workflow in the workspace, ideal for company wide configuration and shared credentials. Workflow scope keeps a variable inside a single workflow. User scope binds a variable to a specific user for personal credentials. A workflow can reference variables from any scope it has access to, with global being the broadest and user the narrowest.

Every secret is encrypted at rest using industry standard encryption with workspace specific keys in a hardware security module. The plain text value is captured only at creation and never written to logs, displayed in the editor again, or returned through the API. Workflows access the decrypted value only inside the execution sandbox at runtime, never crossing back to the editor or any user facing surface.

Rotation updates the value in the variable layer and every workflow that references it picks up the new value on the next run. Workflows currently in flight continue using the previous value for the rest of their execution to avoid mid run inconsistency, then switch on the next trigger. Nothing breaks, no workflow goes down, and the audit log records the rotation with timestamp and user.

Variables use a clean placeholder syntax that reads naturally inside any node field the scope and name wrapped in a clear delimiter, with editor autocomplete. The variables panel browses every variable in scope, lets you click to insert, and shows type and description next to each name. The same syntax works in plain fields, transform expressions, JavaScript blocks, and API request bodies.

Permission to view and edit variables is controlled by the role and permission system. Workspace admins manage global variables. Workflow owners and editors manage their workflow's scoped variables. Individual users manage their own user scoped variables. Secrets are always write only after the first entry regardless of role, so even an admin cannot read a secret back they can rotate, retire, or replace it, but not view the underlying value.

Every variable and secret event is recorded creation, updates, rotations, retirement, scope changes, and every workflow execution that read the variable. Each entry includes the timestamp, the user or workflow, the action, and the resulting state, with secret values never appearing in the log. The audit trail is filterable, exportable, and retained for the lifetime of the workspace.